Post Syndicated from original https://lwn.net/Articles/847735/rss

Version
3.2.0 of the fish shell has been released. New features include undo
and redo support (for command-line editing, not commands!) and a long list
of incremental improvements; see the announcement for details. LWN last looked at the fish shell in September.

Post Syndicated from original https://lwn.net/Articles/847707/rss

Linus Torvalds has released 5.12-rc1
(codename now “Frozen wasteland”) and
closed the merge window despite getting a late start due to bad weather:

So I was actually without electricity for six days of the merge
window, and was seriously considering just extending the merge
window to get everything done.

As you can tell, I didn’t do that. To a large part because people
were actually very good about sending in their pull requests, so by
the time I finally got power back, everything was nicely lined up
and I got things merged up ok.

But partly this is also because 5.12 is a smaller release than some
previous ones.

Post Syndicated from original https://blog.erratasec.com/2021/02/we-are-living-in-1984-eternalblue.html

In the book 1984, the protagonist questions his sanity, because his memory differs from what appears to be everybody else’s memory.

The Party said that Oceania had never been in alliance with Eurasia. He, Winston Smith, knew that Oceania had been in alliance with Eurasia as short a time as four years ago. But where did that knowledge exist? Only in his own consciousness, which in any case must soon be annihilated. And if all others accepted the lie which the Party imposed—if all records told the same tale—then the lie passed into history and became truth. ‘Who controls the past,’ ran the Party slogan, ‘controls the future: who controls the present controls the past.’ And yet the past, though of its nature alterable, never had been altered. Whatever was true now was true from everlasting to everlasting. It was quite simple. All that was needed was an unending series of victories over your own memory. ‘Reality control’, they called it: in Newspeak, ‘doublethink’.

I know that EternalBlue didn’t cause the Baltimore ransomware attack. When the attack happened, the entire cybersecurity community agreed that EternalBlue wasn’t responsible.

But this New York Times article said otherwise, blaming the Baltimore attack on EternalBlue. And there are hundreds of other news articles [eg] that agree, citing the New York Times. There are no news articles that dispute this.

In a recent book, the author of that article admits it’s not true, that EternalBlue didn’t cause the ransomware to spread. But they defend themselves as it being essentially true, that EternalBlue is responsible for a lot of bad things, even if technically, not in this case. Such errors are justified, on the grounds they are generalizations and simplifications needed for the mass audience.

So we are left with the situation Orwell describes: all records tell the same tale — when the lie passes into history, it becomes the truth.

Orwell continues:

He wondered, as he had many times wondered before, whether he himself was a lunatic. Perhaps a lunatic was simply a minority of one. At one time it had been a sign of madness to believe that the earth goes round the sun; today, to believe that the past is inalterable. He might be ALONE in holding that belief, and if alone, then a lunatic. But the thought of being a lunatic did not greatly trouble him: the horror was that he might also be wrong.

I’m definitely a lunatic, alone in my beliefs. I sure hope I’m not wrong.

---

Update: Other lunatics document their struggles with Minitrue:

When I was investigating the TJX breach, there were NYT articles citing unnamed sources that were made up & then outlets would publish citing the NYT. The TJX lawyers would require us to disprove the articles. Each time we would. It was maddening fighting lies for 8 months.

— Nicholas J. Percoco (@c7five) March 1, 2021

Post Syndicated from original https://xkcd.com/2431/

Post Syndicated from original https://blog.erratasec.com/2021/02/review-perlroths-book-on-cyberarms.html

New York Times reporter Nicole Perlroth has written a book on zero-days and nation-state hacking entitled “This Is How They Tell Me The World Ends”. Here is my review.

I’m not sure what the book intends to be. The blurbs from the publisher implies a work of investigative journalism, in which case it’s full of unforgivable factual errors. However, it reads more like a memoir, in which case errors are to be expected/forgivable, with content often from memory rather than rigorously fact checked notes.

But even with this more lenient interpretation, there are important flaws that should be pointed out. For example, the book claims the Saudi’s hacked Bezos with a zero-day. I claim that’s bunk. The book claims zero-days are “God mode” compared to other hacking techniques, I claim they are no better than the alternatives, usually worse, and rarely used.

But I can’t really list all the things I disagree with. It’s no use. She’s a New York Times reporter, impervious to disagreement.

If this were written by a tech journalist, then criticism would be the expected norm. Tech is full of factual truths, such as whether 2+2=5, where it’s possible for a thing to be conclusively known. All journalists make errors — tech journalists are constantly making small revisions correcting their errors after publication.

The best example of this is Ars Technica. They pride themselves on their reader forums, where readers comment, opine, criticize, and correct stories. Sometimes readers add more interesting information to the story, providing free content to other readers. Sometimes they fix errors.

It’s often unpleasant for the journalists who steel themselves after hitting “Submit…”. They have a lot of practice defending or correcting every assertion they make, from both legitimate and illegitimate criticism. This makes them astoundingly good journalists — mistakes editors miss readers don’t. They get trained fast to deal with criticism.

The mainstream press doesn’t have this tradition. To be fair, it couldn’t. Tech forums have techies with knowledge and experience, while the mainstream press has ignorant readers with opinions. Regardless of the story’s original content it’ll devolve into people arguing about whether Epstein was murdered (for example).

Nicole Perlroth is a mainstream reporter on a techy beat. So you see a conflict here between the expectation both sides have for each other. Techies expect a tech journalist who’ll respond to factual errors, she doesn’t expect all this criticism. She doesn’t see techie critics for what they are — subject matter experts that would be useful sources to make her stories better. She sees them as enemies that must be ignored. This makes her stories sloppy by technical standards. I hate that this sounds like a personal attack when it’s really more a NYTimes problem — most of their cyber stories struggle with technical details, regardless of author.

This problem is made worse by the fact that the New York Times doesn’t have “news stories” so much as “narratives”. They don’t have neutral stories reporting what happened, but narratives explaining a larger point.

A good example is this story that blames the Baltimore ransomware attack on the NSA’s EternalBlue. The narrative is that EternalBlue is to blame for damage all over the place, and it uses the Baltimore ransomware as an example. However, EternalBlue wasn’t responsible for that particular ransomware — as techies point out.

Perlroth doesn’t fix the story. In her book, she instead criticizes techies for focusing on “the technical detail that in this particular case, the ransomware attack had not spread with EternalBlue”, and that techies don’t acknowledge “the wreckage from EternalBlue in towns and cities across the country”.

It’s a bizarre response from a journalist, refusing to fix a falsehood in a story because the rest of the narrative is true.

Some of the book is correct, telling you some real details about the zero-day market. I can’t say it won’t be useful to some readers, though the useful bits are buried in a lot of non-useful stuff. But most of the book is wrong about the zero-day market, a slave to the narrative that zero-days are going to end the world. I mean, I should say, I disagree with the narrative and her political policy ideas — I guess it’s up to you to decide for yourself if it’s “wrong”. Apart from inaccuracies, a lot is missing — for example, you really can’t understand what a “zero-day” is without also understanding the 40 year history of vuln-disclosure.

I could go on a long spree of corrections, and others have their own long list of inaccuracies, but there’s really no point. She’s already defended her book as being more of a memoir than a work of journalistic integrity, so her subjective point of view is what it’s about, not facts. Her fundamental narrative of the Big Bad Cyberarms Market is a political one, so any discussion of accuracy will be in service of political sides rather than the side of truth.

Moreover, she’ll just attack me for my “bruised male ego”, as she has already done to other expert critics.